Question on SAS EG Set up

[seshas23]

Good Afternoon,

I would like to understand how to encrypt the communication ( data/user name password  in transit ) between SAS EG and Oracle Db . I understand that the communication between EG and the workspace server can be encrypted. It could be credentials-only or everything and there are a few different algorithms available.

However as per my understanding when we connect to any third party DB example Oracle from SAS EG , the only option available for encryption is by installing the corresponding client on SAS based on the encryption supported by Oracle DB .

Can SSL be used for encryption between SAS EG & Oracle DB ?

Can someone please clarify .

Thank you ,

[nhvdwalt]

I know exactly what you mean, but maybe just to clarify for other forum members. I know this is semantics, but let's use the right wording....

SAS EG does not talk to any databases e.g. Oracle directy. Like you said SAS EG connects to a workspace server, typically on a server, or even local PC SAS. THAT instance of Base SAS then connects to Oracle using either an ODBC or Oracle client, depending on what SAS/Access engine your are licensed for.

Assuming your have SAS/Access to Oracle installed on your SAS server, your question is then around the communication between the Oracle client and the Oracle database across the network. I'm no Oracle expert, but I can only imagine Oracle must have different options available, just as SAS has many encryption options available. For example, have a look at the below link. Also engage with the Oracle support team at your site since the Oracle software is ultimately their responsibility. I cannot think it would make a difference to SAS, since the encryption sits between the Oracle Client and the Database.

https://docs.oracle.com/cd/E11882_01/network.112/e40393/asoconfg.htm#ASOAG020

[seshas23]

Thank you so much for clarifying . I will work with the Oracle Team to get this configured.

[george_georgiou · Accepted solution]

Hi,

My name is George and I am a Technical Support Engineer at SAS.  There is a method of authentication from the SAS side of things that you could look into, which is called IWA (Integrated Windows Authentication).

If you configure your environment to use this approach of authentication then you would be taking advantage of the Kerberos mechanism which is designed to provide strong encryption by using secret-key cryptography. 

IWA is a single sign-on approach that delegates Windows credentials across a client/server connection, i.e. from EG to the SAS Workspace server, with the ability to also authenticate to your third-party sources like Oracle.

Additional configuration would have to be done to get an Oracle DB to recognize a Kerberos token.

You can read more about this method here:

http://go.documentation.sas.com/?docsetId=bisecag&docsetTarget=n0go7pclcqr6q2n1bxfuk46hmtdy.htm&docs...

Here is the process on how to configure IWA in a SAS environment for use with the SAS Enterprise Guide client:

http://support.sas.com/documentation/cdl/en/bisecag/63082/HTML/default/viewer.htm#n1d1zo1jsf2o0en1eh...

Here is some information on configuring Kerberos to work with Oracle Databases:

https://docs.oracle.com/cd/B28359_01/network.111/b28530/asokerb.htm#g1012894

[seshas23]

Thanks George. Yes , we do plan to use the IWA - thanks for pointing out the Kerbros token approach - I will suggest that to the Oracle DBA and try that approach .